Bitcoin and encryption: a race between criminals and the FBI

Whether it was gangsters a century ago speeding off in faster getaway cars or terrorists and hackers in recent decades who shielded their communications through encrypted apps, criminals have perennially exploited technology to stay a step ahead of law enforcement.

The FBI struck back in the past week with a pair of victories: a seizure of most of the $4 million ransom in Bitcoin that Russian hackers extorted from a U.S. pipeline operator and the announcement of a yearslong sting where thousands of suspects were duped into using a messaging app secretly controlled by authorities. More than 800 people were arrested in more than a dozen countries.

The breakthroughs came in part because law enforcement officials learned how to leverage two rapidly advancing technologies — encryption and cryptocurrencies — that had previously been a boon for criminals.

Yet the events did little to fundamentally alter the challenges for authorities in an increasingly digital world, according to former law enforcement officials, prosecutors, historians and technology experts. The global sting is highly unlikely to keep criminals from using encryption and could encourage them to go even further underground, experts said. And while the FBI has shown that it can recover stolen cryptocurrencies, doing so requires resources beyond the reach of most law enforcement agencies.

Ultimately, the cases were the latest iteration in the decadeslong back and forth between lawbreakers and the FBI in which both sides have seized on technological advances, whether it is criminals hiding behind encryption or investigators exploiting facial recognition, drones and other mechanisms.

“You get a sharper sword; they get a stronger shield. The greed of the bad guys is always stronger than the reach of the good guys,” said Tim Weiner, author of “Enemies: A History of the FBI.” “That’s not just the story of the FBI; it’s been true throughout the history of warfare.”

Now law enforcement agencies are seeking more access to digital devices, sometimes buying hacking tools from the private sector, and urging lawmakers to give them more power to track suspects.

“This does not end the debate on encryption,” said Joseph DeMarco, a former federal prosecutor in Manhattan who has spent years working on cybercrime. “It shows that law enforcement is willing to design flanking maneuvers to go around encryption obstacles. But the debate about whether or not those workarounds are adequate will continue.”

LAW ENFORCEMENT GAINS

Technology has not been all bad for the police. Beyond facial recognition and drones, authorities in the United States use gunshot detectors and devices that simulate cell towers to surreptitiously connect to suspects’ phones and determine their location.

Law enforcement also has an advantage when it gets hold of digital devices. Despite claims from Apple, Google and even the Justice Department that smartphones are largely impenetrable, thousands of law enforcement agencies have tools that can infiltrate the latest phones to extract data.

“Police today are facing a situation of an explosion of data,” said Yossi Carmil, CEO of Cellebrite, an Israeli company that has sold data extraction tools to more than 5,000 law enforcement agencies, including hundreds of small police departments across the United States. “The solutions are there. There is no real challenge to accessing the data.”

The police also have an easier time getting to data stored in the cloud. Technology companies like Apple, Google and Microsoft regularly turn over customers’ personal data, such as photographs, emails, contacts and text messages, to authorities with a warrant.

CHALLENGE OF ENCRYPTION

Yet intercepting communications has remained a troublesome problem for the police. While criminals used to talk over channels that were relatively simple to tap — like phones, emails and basic text messages — most now use encrypted messengers, which are not.

Two of the world’s most popular messaging services, Apple’s iMessage and Facebook’s WhatsApp, use so-called end-to-end encryption, meaning only the sender and receiver can see the messages. Not even the companies have access to their contents, allowing Apple and Facebook to argue that they cannot turn them over to law enforcement.

Authorities’ frustration has prompted them to target smaller encrypted apps favored by criminals. In July, the police in Europe said they hacked into one called EncroChat, leading to hundreds of arrests.

That pushed many criminals onto a new service, Anom. They had to buy specialized phones with few working features, aside from an app disguised as a calculator. With a code, it would turn into a messaging app, Anom, that claimed to be encrypted.

In fact, the FBI created Anom. The bureau and the Australian police started the operation by persuading an informant to distribute the devices to criminal networks, after which they caught on by word-of-mouth. After three years, Anom had more than 12,000 users.

Criminals felt so comfortable on the service that they stopped using coded language, sending photos of smuggled cocaine shipments and openly planning murders, the police said. And when authorities obtained court approval to surveil any Anom users, they could easily monitor their messages.

But when the police carried out hundreds of arrests and detailed the scheme to news cameras this past week, the ruse was over. Authorities were once again in the dark.

AN ATTRACTIVE TOOL FOR CRIMINALS

For years, Bitcoin and other digital currencies were the coin of choice for international criminal syndicates. The qualities that make cryptocurrencies attractive — decentralization and anonymity — make them great for theft, ransom and selling drugs.

Getting paid used to be the hardest part of holding something or someone hostage, said Ross Anderson, a cybersecurity researcher at the University of Cambridge who studies how the police and criminals use technology.

“It’s easy enough to grab the heiress or her dog, but the problem then is that when you threatened to cut her ear off and asked Mr. Rockefeller to send you a large suitcase full of dollar bills, the police tagged along, or they put a radio transmitter in it,” he said. “With Bitcoin, you can get actually quite substantial extortion amounts, like seven- and eight-figure sums, which can be delivered instantaneously to Russia or North Korea or wherever.”

That new model fueled a surge in ransomware attacks, where hackers take control of a person’s or company’s computers and demand a ransom. Recorded Future, a security company that tracks such attacks, estimated that last year, one attack occurred every eight minutes.

Ransomware attacks have recently hit hospitals, meatpackers, minor league baseball teams and the ferries to Martha’s Vineyard. Many companies pay the ransoms because it is easier and faster than alternative solutions, despite also giving hackers more incentive.

Yet the Colonial Pipeline case showed that the police could also use cryptocurrencies to their advantage. Each transaction is recorded in a public ledger, making the money traceable even as it travels from one anonymous account to the next. That means that law enforcement with enough money and know-how can typically hack into an account and snatch back the money.

But hacking can be expensive and time-consuming, leaving few agencies outside the FBI with the ability to do it.